Social engineering is basically any way you trick somebody into
doing what you want.
In the context of information security, that means asking them very politely to
run your malware for you via something like an office doc macro, or
just simply sending them executable code which we see all the time.
It could be, please tell me your password.
And actually the last couple of years, there's been an emphasis on what
we would call, identity deception attacks where you have somebody usually in
a position of authority saying, please change the bank account for
this transaction, or please direct payroll here, or if you're really
dealing with the bottom of the barrel, please send me iTunes gift cards.
And frankly, most cyber attacks rely on it to one extent or another.
Because it's so much easier than finding a technical vulnerability in a modern
operating system or a browser.
For me to find one of those,
probably requires the expertise that only a few people in the world have.
And if you find a technical vulnerability that actually works for
something that's worth attacking, like say Chrome, or iOS, or Android,
or Windows 10, that's worth millions.
I'm simply not going to use that to try and scam a couple hundred thousand dollars
out of a single organization when I could sell it for far more.
And it's different in every organization.
We'll see some common patterns.
Everyone thinks that their most senior people are going to be the ones that
are naturally targeted.
And that's true occasionally,
particularly when those senior people are very high profile.
On the other hand, most organizations are somewhat surprised by the people that
their adversaries tend to target.
Because someone will have put something on LinkedIn or something else on the Internet
that really is a great opportunity for a cybercriminal that they're simply not
going to pass up, that the organization is probably not aware of.
In the healthcare world,
the most commonly targeted titles involved nursing and pharmacy.
The latter of which is obvious.
The former of which is targeted because nurses have so
much access to patient data.
If you look at banking, if you have something like SWIFT operator, or
the word payments in your title, you're much more likely to be targeted and
one of your colleagues.
The thing with the cybercriminals,
I think a lot of people get wrong is you think of them as these technical geniuses.
And as it happens, there's a few of them.
But the vast, vast,
vast majority of the players in that whole ecosystem are not very smart technically.
And frankly, don't have to be.
This is just an evolution of pre-existing forms of organized crime.
Those groups almost entirely rely on tools that they buy.
And they're incredibly effective at what they do, but
they don't actually have to have any kind of magical hoodie wearing,
leather trench coat hacker expertise that we tend to associate with them.
What they're really good at doing is,
as we spoke about social engineering, if they can do research,
if they can look at LinkedIn, they can look at Facebook, they can look at
all of the things that a Google search terms up about a given target.
They can figure out exactly who they want, what type of access they'll need, and
then how to actually translate that into a transaction.
They don't really care about the technical tools to get them from here to there and
it's easier for them if they don't have to use any of them.
Social engineering is one of those things that is a bit of a bummer because frankly,
most of us should want to trust our fellow person, right?
We should want to help other people, and that's what cybercriminals are preying on.
The fact that most of us are good people, we want to do things,
especially if we're asked to do them.
But to some extent, email needs to be an exception to that because the typical
way is anyone of us is going to run into a social engineering attempt is email,
SMS and robocalls.
And there's a couple of really simple,
really good pieces of advice that almost anyone can follow.
The first one, just don't click on an email, that's an obvious one.
And the second one, use a password manager and
ideally connect that password manager to multifactor authentication.
Too many people just don't manage that whole process well.
And the thing that is the clearest about cyber security risk for
the average person is that, it's not going to be some fancy hacking
that ends up costing you time, money, or something worse than that.
It's going to be something that was probably within your control.
And if you can use a password manager, update your software regularly,
use multi factor authentication, and again, don't clicking on any emails.
Do those things, you're probably gonna be in good shape.
[MUSIC]